Schneier On Full Disclosure

Bruce let me know that he's written a piece on ZDNet (original home of the for the Window of Exposure idea is on Counterpane ^? ) about the problems of not following full disclosure. Very well written and does a great job of summarizing why full disclosure works. The original piece from Culp @ Microsoft is also available, along with the PowerPoint that they did.

Comments

Remember!

[athakur999]

Full disclosure may be good, but full exposure will get you thrown in jail!

Microsoft's answer to Full Disclosure

[Phydoux]

Everybody seems to like "Full Disclosure," so here at Microsoft, we've decided to begin releasing all security vulnerabilities under a "Shared Disclosure" policy. Once the various NDAs are signed, you too can view and work with any security vulnerabilities that we know about.

Just another example of how Microsoft listens to and responds to customer requests. Have a nice day!

Grace Period

[Exmet Paff Daxx]

From the powerpoint slide:

Grace Period
Purpose: Give users a reasonable interval during which to protect their systems against newly reported vulnerabilities
- Begins with public notice of vulnerability, and lasts for 30 days
- Is immediately curtailed if vulnerability becomes actively exploited

Do I read this correctly? Does this mean that when an exploit is shown to exist in the wild, then they immediately switch to "full disclosure" mode? This means that there is now an incentive to put an exploit in the wild: it means you can publish your work. Even if you leak the exploit surreptitously.

I know I must be preaching to the choir here, but, this seems exceedingly stupid. Am I missing something?

Re:Grace Period

[nebby]

Well, not really.

If you're a responsible researcher who discovered the exploit, your work will eventually be published upon the release of a patch.

The reason, I'd assume, that "full disclosure" mode is enacted upon seeing the exploit be out in the wild is to put some fire under the ass of those responsible to get a patch out. It hightens the level of urgency. I think this makes sense actually, since in most cases a patch will be released during the grace period (theoretically) before the exploit is actually seen in the wild.

I was actually going to propose a grace period as a "solution" to the problem, before I realized Microsoft was pushing for a grace period. I'm not fond of the month long period though, I'd expect it to be more like a week and a half to two weeks. Having hack-able boxes sitting open for a month when someone out there knows how to get into them is irresponsible. Giving manufaturers two weeks to get themselves together before the script kiddies come full on though seems like a good idea to me.

Re:Grace Period

[illusion_2K]

No. It means that if there is a known exploit in the wild then it is legitimate to post information about the vulnerability that it pertains to.

Let's say for a second that I'm a network administrator (which I have been) or in a related position. Would I want to know about how someone will be able to break into my network or servers? You bet I would. What if it was possible to avoid being affected by the exploit by changing default settings or shutting down services temporarily? I think whatever inconvience that might cause would be outweighed by keeping my network secure.

Obviously you haven't had to deal with this sort of stuff before. I'd suggest you do a quick search through the Bugtraq archives for informed discussions on vulnerability disclosure. In the information security world it's a topic which has (almost) been flogged to death.

Re:Grace Period

[elmegil]

Some companies' qualification time takes longer than two weeks. Unless you think unqualified patches are a good idea, giving them time to make the process work is not a bad idea. As it is 30 days is a hard accelleration of most patch qual times.

Re:Grace Period

[morcheeba]

Is immediately curtailed if vulnerability becomes actively exploited

How exactly do they know if the vulnerability has been exploited? A box owner may not realize they've been exploited, and even then may not know the exact exploit used. What are the chances of this information getting back to microsoft before boxes #2-#200,000 are exploited?

Second, think of the attitude this takes towards customers: They won't give full disclosure until one of their customers is compromised? Sounds like a hostage sitatuion to me.

And, for the obligitory "if microsoft was a car company" comparison:

Partial disclosure: "one of the 4 seatbelts in your car can fail. Don't worry, there is a 80% chance that its not the seat you're sitting in."
Full disclosure: "Don't sit in the rear passanger seat until you get the belt replaced."

Would you like your car company to say not give full disclosure for 30 days or until someone died?

Re:I am for full disclosure but...

[sphealey]

would you extend these arguments to support it in non-virtual security? Should the CIA and other international organizations use full exposure? Should they publish something titled, "This is the vulnerability of our Nuclear Piles"?

Unfortunately, it isn't that simple. Read the history of the Manhatten Project. The FBI actually succeeded in its goal of not allowing a single leak of information out of the project [1]. It was the lack of published information on atomic research in the US in 1940 and 1941 that told Kurchatov that something was "up" and motiviated him to write a letter to Stalin suggesting that the Soviet Union get moving on atomic bomb research.

So just hiding information doesn't necessarily make you more secure.

sPh

[1] OK, the Soviet Union had spies inside the project before it started, but that doesn't count!

Re:Sometimes you should shout "Fire"

[squidfood]

When you see a fire in a crowded theatre, you:

(A) Shout "FIRE!" and get crushed in the panic.
(B) Walk out quietly...who cares about anyone else?
(C) Tell your closest neighbor and hope that they're a fireman.
(D) Pour on gasoline so everyone will get out faster.

Re:I am for full disclosure but...

[jmauro]

This is the vulnerability of our Nuclear Piles

This is where you can cross the border undetected

This is how to make a Fake ID?

Well maybe I didn't say every single tiny little syllable but basically I said em, basicly.

What Culp actually said...

[JMZero]

Culp makes a lot more sense than he's given credit for, and a lot of his points have been taken out of context. The procedure he outlines seems very reasonable to me:

"Most of the security community already follows common-sense rules that ensure that security vulnerabilities are handled appropriately. When they find a security vulnerability, they inform the vendor and work with it while the patch is being developed. When the patch is complete, they publish information discussing what products are affected by the vulnerability, what the effect of the vulnerability is... and what users can do to protect their systems....

"Some security professionals go the extra mile and develop tools that assist users in diagnosing their systems and determining whether they are affected by a particular vulnerability. This too can be done responsibly...

Re:I am for full disclosure but...

[iabervon]

The CIA and such are, in this case, in the position of the vendors: it is their responsibility to fix the vulnerabilities.

The disclosure should be done by people who identify the vulnerablities. If you know where you can cross a border undetected, you ought to let someone know. Particularly in that case, the hole would probably get closed pretty quickly. And if some random person notices a hole, it would be pretty easy for someone actually looking for a vulnerability to find it.

For example, if in August (or before) someone had said to the general public something like, "You can probably hijack an airplane with legal objects and then destroy a building with it", the passengers wouldn't have let the hijacking get anywhere, and the hijackers probably wouldn't have tried. There's obviously the risk that some groups that wouldn't have thought of it would get the idea, but it would have gotten fixed in policy before anyone could do anything to exploit it.

Re:I am for full disclosure but...

[EXTomar]

Full disclosure is meant to help increase security in dynamicly changing and (supposedly) supported software.

You will note that if you read the article and this is probably the only time where "bug secrecy" is necessary, that is it extremely bad to publish a bug for non-fixable systems(like air traffic control computers). It is good in one sense that the exploit is known (so that they avoid it the next time) but it is bad to let it loose if the system is still deployed and can not be changed and aren't going away soon.

So the continue the allogy, it isn't good to disclose vulnerabilities of nuclear stockpiles because you can't fix them.

You are in luck

[Erris]

Should the CIA and other international organizations use full exposure? Should they publish something titled, "This is the vulnerability of our Nuclear Piles"? "This is where you can cross the border undetected", "This is how to make a Fake ID?"

Wow, what a troll. The CIA being an "international organization" is a dead give away. The other is the fantastic false analogy between buggy PC software and nuclear bombs. No orgainization currently mass produces nuclear weapons for daily use on every desktop. No one here would recomend such things.

At the same time, some countries like the USA, recognize that free thought is needed for scientific development and that full disclosure and broad education are in the public interest. While the particular techincal details of how to build bombs is kept secret, the physical priciples are trumpeted and encouraged. Indeed public debate on priciples are encouraged as free dicourse leads to knowledge. "Freedom is the ability to say two plus two is four, all else follows", said George Orwells sad character in 1984. While the Department of Energy and their employees might not tell us details, they will not keep you or me from talking about it. With sufficient study at any good US University, a person can learn all they need to know about bomb design. Knowledge is not yet viewed as evil. The truth will set you free and only the free can be sure they know the truth.

M$, Adobe, RIAA, MPAA and other private interests are going a step further than cold warriors with their "information anarchy" campaign. Such blatant censorship is un-American and against the public interest. They will be defeated in the long run, as will trolls like you.

That innocent little list o' worms

[carambola5]

Anyone else notice the peculiarity of the list at the beginning of Culp @ Microsoft? Let's see....

• Code RedMicrosoft worm.
• LionLinux worm
• SadmindSolaris worm that affected Microsoft OS's (*ack* if you can call them OS's!)
• RamenLinux worm
• NimdaMicrosoft worm

Now that means that a "representative" list of worms would contain 50% Microsoft worms, 40% Linux worms, and 10% Solaris worms. It's good to see Microsoft presenting a legitimate picture of what's going on. C'mon!! Windows practically breeds worms! Linux has had how many? 4, 5? Morris, Ramen, Lion, Adore. That's all I can come up with. Now, do I start listing the Microsoft worms (not to mention virii)?...
-------------
All your sig are belong to us.

Re:That innocent little list o' worms

[sheldon]

If you follow incidents.org, those linux worms have been a pretty big headache. There's still a lot of linux boxes out there scanning for BIND and so forth.

Beware of the "Fire" argument

[kingdon]

The argument that you can't just shout "fire" in a crowded theater entered the law in Schenck v. United States, 249 U.S. 47, 52 (1919). This was a Supreme Court case concerning whether the government may suppress pamphlets encouraging people to resist the draft. Although I think that case may have been correctly decided (with the distinction being expressing opposition to the draft versus encouraging people to violate the draft law), I wonder if the Court realized they were treading on, or near thin ice, when they used the "Fire" analogy.

So it is with people who use the analogy today. Whenever someone start comparing some kind of speech to shouting "Fire" in a crowded theater, don't get carried away by the emotional appeal but keep an eye on your rights, lest someone try to make off with them.

Re:I am for full disclosure but...

[Fencepost]

I've heard reports that one of the things that raised questions was "Where did all the silver go," but while it's clear that it was used I haven't found any notes about what impact (if any) this might have had on market prices.

Copper was being used elsewhere in the war effort, so:

At one point during the Manhattan Project, they needed a lot of copper. They were going to build plants in Utah to manufacture uranium and needed an estimated 10,000 to 15,000 metric tons of copper. Unfortunately, due to other war requirements, this much copper was not available. Someone suggested that the Manhattan Project go to the United States Treasury and ask for silver. Which they did.

and

For the record we should note two things about our story. First, the Manhattan Project eventually used somewhere around 13,000 metric tons of silver. A current valuation would be about $6,000,000,000. Second, they gave it all back.

Swiped from http://members.aol.com/fmcguff/dwmodel/intro.htm

Software liability and disclosure

[shimmin]

Bruce makes a good point regarding software liability laws, or rather the lack thereof.

Almost every piece of commercial software you install these days has something in the license like (taken from the Red Hat legalese):

"There is no warantee for the program, to the extent permitted by applicable law. Except when otherwise stated in writing by the copyright holders and/or other parties provide the program "as is" without warranty of any kind, either expressed or implied, including, but not limited to, the implied warantees of merchantability and fitness for a particular purpose. The entire risk of as to the quality and performance of the program is with you. Should the program prove defective, you assume the cost of all necessary servicing, repair, or correction."

Now someone explain to me why, when software vendors disavow all responsibility for their products, they should be granted some special status with regards to information about those products' misbehavior.

Re:Regardless

[rodgerd]

You sound suspiciously like someone who doesn't have sufficient experience in the NT world.

Windows patches and hotfixes are a whole world of pain. SP2 for NT4 erased filesystems. SP6 crippled people running Notes. Hotfixes regularly blow each other away. They're a *mess*, and a good Windows admin will be *very* cautious about applying either hotfixes or service packs for NT/W2K/XP because the QA on them seems to be so low, so often.

Re:I am for full disclosure but...

[PD]

Someone suggested that the Manhattan Project go to the United States Treasury and ask for silver.

Of course, this was before somebody suggesting using Uranium and Plutonium. They gave the silver back because it wouldn't blow up. Uranium makes really lousy money on the other hand. Is has a good weight, and it's a bit warm to the touch, giving it a nice feel in your hands. But it tended to cause tumors on the upper thigh, right where trouser's pockets are. So for the treasury and the war department, it was what you'd call a "win-win situation".

Counterpane conflict of interest

[sigwinch]

In fact, if anything, Schneier has a conflict of interest in that the less secure the Internet is, the easier it will be for him to sell his services.

OTOH, the more secure the Internet is, the less work Counterpane has to do to provide a particular level of service. It analogous to insurance companies that require certain fire countermeasures as a condition of providing insurance (extinguishers, real firewalls, sprinklers, ...). It is not obvious where the line between conflict of interest and public service is drawn though.